I-SiamIDS: an improved Siam-IDS for handling class imbalance in network-based intrusion detection systems

1. Introduction

• Minority classes contain infrequent attacks, and their limited training samples are linked to more unidentified intrusions, or false negatives.The paper contrasts this algorithm-level challenge with data-level approaches that increase or decrease class sample counts.Source: §1 · p. 2
• Oversampling, undersampling, and SMOTE balance datasets, but the paper notes risks of overfitting, information loss, and unrepresentative synthetic samples, respectively.These drawbacks motivate algorithms that classify minority attack classes directly.Source: §1 · p. 2
• I-SiamIDS is an algorithm-level two-layer ensemble of XGBoost, Siamese-NN, and DNN proposed to handle class imbalance without dataset balancing.It builds on Siam-IDS, which the authors describe as having acceptable Recall but low Precision.Source: §1 · p. 2
• I-SiamIDS improved Accuracy, Recall, Precision, and F1-score for multi-class classification and AUC for binary classification on both NSL-KDD and CIDDS-001.The paper also reports comparisons with Siam-IDS, DNN, CNN, Random Forest, and XGBoost.Source: §1 · p. 3
• Its first layer hierarchically separates benign and malicious samples, and its second classifies detected attacks into attack categories.The paper also reports computational-cost analysis as an indicator of system acceptability.Source: §1 · p. 3

Deep Neural Network

• A DNN is a fully connected feed-forward network whose hidden layers apply nonlinear activations and whose output layer produces class probabilities.Training adjusts the weights through backpropagation when the highest-probability label differs from the actual label.Source: §2 · p. 3

Siamese Neural Network

• Siamese-NN compares paired inputs using a similarity score computed from feature representations produced by two identical neural networks.The networks share weights, and the described I-SiamIDS background notes Euclidean distance as the similarity function in Siam-IDS.Source: §2 · pp. 3–4

XGBoost

• XGBoost builds successive decision-tree learners to reduce earlier prediction errors, while its objective combines a loss function with regularization.I-SiamIDS uses binary XGBoost in the first layer to separate benign and malicious samples and multi-class XGBoost in the second to classify attacks.Source: eXtreme Gradient Boosting (XGBoost) · p. 4

NSL-KDD dataset

• NSL-KDD has 22 attack types grouped into four attack categories, with normal, DoS, and Probe as majority classes and R2L and U2R as minority classes.The training and testing files contain 125,973 and 22,544 samples, respectively, each with 41 attributes and a class label.Source: eXtreme Gradient Boosting (XGBoost) · p. 4, Table 1 · p. 5

CIDDS-001 dataset

• CIDDS-001 is a unidirectional NetFlow dataset with benign traffic and four attack types; the experimental subset includes all 70 OpenStack sub-attack categories.The dataset was generated using an emulated business environment, and the subset was selected because of the dataset's large size.Source: eXtreme Gradient Boosting (XGBoost) · p. 5, Table 2 · p. 5

3. Literature Review

• Data-level balancing may improve offline training, but does not equip NIDSs to detect novel or infrequent traffic when training samples are limited.The review calls for algorithm-level approaches that filter novel and infrequent traffic without modifying the available training samples.Source: §3 · p. 7
• Accuracy alone can conceal poor minority-class detection because majority-class predictions may remain correct while minority samples are misclassified.The review also notes prior evaluations that omitted class-wise analysis, including the binary-only evaluation described by Gurung, Ghose, & Subedi (2019).Source: §3 · pp. 5–7
• Siam-IDS used Siamese-NN without dataset balancing and achieved high Recall but low Precision, which I-SiamIDS aims to improve.The paper evaluates I-SiamIDS using Accuracy, Recall, Precision, and F1 on NSL-KDD and CIDDS-001, plus binary-classification AUC and execution time.Source: §3 · p. 7
• I-SiamIDS separates attack identification from attack classification, unlike Siam-IDS's single-layer multiclass classification.Its first layer filters input samples; the second classifies identified attacks, and the paper reports that m-XGBoost performs attack classification better than Siamese-NN.Source: §3 · p. 8

4. Proposed I-SiamIDS

• I-SiamIDS separates binary attack identification in Layer 1 from attack-category classification in Layer 2.The first layer uses hierarchical filtering to reduce misclassified malicious traffic; the second classifies identified attacks into dataset-specific categories.Source: §4 · pp. 8, 10
• Three Layer 1 classifiers were selected: Siamese-NN, b-XGBoost, and DNN.b-XGBoost and DNN were top performers on NSL-KDD; on CIDDS-001, DNN and KNN performed best, but b-XGBoost replaced KNN because KNN was considered too time-consuming for large datasets.Source: §4 · p. 9
• More than three Layer 1 classifiers brought only marginal improvement while adding overhead, and varied classifiers were preferred to reduce shared class bias.The paper reports that using the same best-performing classifier more than once may fail to identify a specific class of samples.Source: §4 · p. 9
• Any of the three Layer 1 classifiers can send a sample to Layer 2 when it predicts an attack; a sample proceeds through the sequence only when earlier classifiers predict normal.A sample is accepted as normal only if all three classifiers predict normal.Source: §4 · p. 9
• All six tested classifier permutations produced the same combined result for each dataset, so P5 (XGBoost => Siamese-NN => DNN) was chosen.The intermediate results differed, but the combined results were identical for the corresponding dataset.Source: §4 · p. 10
• m-XGBoost was selected for Layer 2 because it performed better than Siamese-NN on the multi-class training and testing datasets.NSL-KDD categories are DoS, Probe, R2L, and U2R; CIDDS-001 categories are DoS, Port Scan, Ping Scan, and Brute Force.Source: §4 · p. 10

• After quantization and normalization, b-XGBoost, Siamese-NN, and DNN filter samples sequentially; samples flagged as attacks go to m-XGBoost for attack-class assignment.The datasets were normalized to [0, 1].Source: Normalization · p. 12, Quantization · p. 12
• NSL-KDD precision was near competitors (highest for Normal); lower I-SiamIDS U2R/R2L precision is contextualized by high DNN/CNN scores from few predictions.Source: Normalization · pp. 13–14
• I-SiamIDS led recall across NSL-KDD attack classes and achieved the best F1 for Normal, Probe, R2L, and U2R, with DoS F1 close behind.Source: Normalization · p. 13, Figure 5 · p. 14, Figure 7 · p. 15
• On CIDDS-001, recall ranked second for Ping Scan and Brute Force and among the top three for other classes; F1 was best for Normal and Brute Force and top-three otherwise.Precision was highest for Normal, Port Scan, and Brute Force, and second-best for the remaining classes.Source: Normalization · p. 15, Figure 8 · p. 15, Figure 9 · p. 16
• I-SiamIDS had the highest AUC for NSL-KDD attacks and CIDDS-001 normal samples, and ranked second to RF for CIDDS-001 attacks.For NSL-KDD normal samples, its AUC was described as satisfactory but not far behind competitors.Source: Table 3 · p. 17, Normalization · p. 17
• Testing-time costs varied: I-SiamIDS was faster than XGBoost for both NSL-KDD classes, but CIDDS-001 attack testing took 1.0720 seconds per sample, exceeding all listed counterparts.Average testing times were computed from ten random normal and attack samples per dataset.Source: Normalization · p. 18

6. Conclusion

• I-SiamIDS achieved higher Accuracy, Recall, Precision, F1 scores, and AUC values than five benchmark algorithms on NSL-KDD and CIDDS-001.The comparisons included DNN, CNN, Random Forest, XGBoost, and Siam-IDS.Source: §6 · p. 19
• Its first layer hierarchically filters network data into benign and malicious samples using an ensemble of binary XGBoost, Siamese Neural Network, and Deep Neural Network classifiers.The identified attacks are passed to a second layer, where multiclass XGBoost classifies them into four main attack categories.Source: §6 · p. 19
• I-SiamIDS was trained and tested on NSL-KDD and CIDDS-001 without data-level balancing techniques.Source: §6 · p. 19
• Computational-cost analysis found the proposed method acceptable in terms of execution time.Source: §6 · p. 19

Appendix

• Figure 13 presents permutations of Layer 1 classifiers for the NSL-KDD dataset.Source: Figure 13 · p. 24
• Figure 14 presents permutations of Layer 1 classifiers for the CIDDS-001 dataset.Source: Figure 14 · p. 25